This password-stealing phishing attack comes disguised as a fake meeting request from the boss

From zdnet.com

A widespread phishing campaign is targeting executives across a number of industries with messages asking to reschedule a board meeting in an effort to steal logins and passwords.

Spotted by researchers at security firm GreatHorn, the phishing messages spoof the name and email address of the CEO of the company being targeted and uses a subject line including the company name and a note about the meeting to gain the attention of potential victims. Users are more likely to fall for attacks they believe to come from their boss.

The contents of the phishing email is simple: it says a board meeting has been rescheduled and asks users to take part in a poll to choose a new date.

If users click the link, they’re taken to a webpage which appears to be a login page for Microsoft Outlook and Office 365, but this is in fact a phishing site — any information entered into it will go directly into the hands of the attackers.

Read more…